CVE-2026-116071 rotki CVE debrief

Who should care

Defenders responsible for cryptocurrency portfolio management applications, specifically those using rotki's premium cloud backup features, should assess their exposure and take immediate action to secure their installations.

Why it matters

CVE-2026-116071 is a high-severity vulnerability in rotki that allows attackers to brute-force backups due to weak key derivation. Defenders should verify exposure, assess security, and prioritize upgrading to version 1.44.2 or later.

• GPU-parallel offline password guessing attacks can be performed by attackers who obtain a backup blob.
• Decrypting the database containing exchange API keys, secrets, wallet addresses, and transaction history is potentially possible.
• Secure password practices and protection of backup files are crucial to mitigating this vulnerability.
• Verification of exposure and security of rotki installations is required.

Technical summary

The vulnerability in rotki versions before 1.44.2 is caused by a weak key derivation mechanism for premium cloud backups. The premium sync key is generated as a single unsalted SHA-256 hash of the user's password, making it susceptible to GPU-parallel offline password guessing attacks. Attackers who obtain a backup blob can potentially decrypt the database containing sensitive information such as exchange API keys, secrets, wallet addresses, and transaction history. This vulnerability allows attackers to brute-force backups due to weak key derivation, enabling GPU-parallel offline password guessing attacks. Defenders should verify exposure, assess security, and prioritize upgrading to version 1.44.2 or later.

Defensive priority

Defenders should prioritize verifying exposure and assessing the security of their rotki installations, especially if they use premium cloud backup features. Immediate action is required to upgrade to version 1.44.2 or later and to educate users about secure password practices and the importance of protecting backup files.

Recommended defensive actions

• Verify if the rotki installation is using premium cloud backup features and assess the exposure to potential attacks.
• Upgrade to rotki version 1.44.2 or later to address the weak key derivation vulnerability.
• Educate users about the importance of using strong, unique passwords and protecting backup files.
• Consider implementing additional security measures such as multi-factor authentication for accessing sensitive data.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and associated references provide details about the vulnerability, its impact, and potential mitigations. However, the corpus does not establish definitive exploitation or victim data. Key sources include the CVE Program, NVD, and various GitHub references related to rotki.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.